High priorityDisclosed

Advisory · CVE-2026-93434

XPath injection in WatchGuard Fireware OS SSH authentication can extract firewall configuration

WatchGuard Fireware OS contains an XPath injection flaw in its SSH authentication process that allows a remote unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data with a specially crafted request. CVSS 4.0 8.7.

Advisory published October 27, 2026Independent summary
Vendor
WatchGuard
Product
Fireware OS
Identifier / CWE
CVE-2026-93434
CWE-643
Action timing
Immediate
ELI5

Explain it like I’m five

The firewall's SSH sign-in asks an internal database questions built from what the caller types. By phrasing the input as part of the question, a stranger can make it answer with pieces of the firewall's own configuration.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Management SSH reached

    The attacker can reach the firewall's management SSH interface.

  2. 02Crafted request submitted

    The attacker submits a specially crafted request to the SSH authentication process.

  3. 03XPath query manipulated

    The injected expression changes the query the process runs against its configuration data.

  4. 04Configuration extracted

    The attacker extracts sensitive configuration data from the responses.

What happened

WatchGuard published CVE-2026-93434 on October 27, 2026, rated high at CVSS 4.0 8.7: an XPath injection vulnerability (CWE-643) in WatchGuard Fireware OS’s SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request.

WatchGuard’s record lists Fireware OS 2025.1 before 2026.4 and 12.0 before 12.12.4 as affected, and 12.0 before 12.5.22 on T15 and T35 appliances, making 2026.4, 12.12.4, and 12.5.22 the fixed releases for their branches.

What to do

  1. Inventory WatchGuard Firebox appliances and note the Fireware OS version and model of each.
  2. Upgrade to Fireware OS 2026.4, 12.12.4, or 12.5.22 (T15 and T35) or later, matching the branch in use.
  3. Until upgraded, restrict management interfaces, cluster interfaces, and proxied services to the smallest set of trusted networks possible.
  4. Review firewall logs for unusual traffic to the affected services, configuration changes, and new administrative accounts.
  5. Verify the running Fireware OS version after upgrading, including clustered pairs and standby units.

Management note

Firewalls are the perimeter and the prize. A batch of remotely reachable Fireware flaws should be patched as a single emergency change, with clustered and standby units explicitly counted, because the appliance everyone forgets is the one that gets used.